Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.6Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowi…Check if you run itEPSS 0.27%Oct 12, 2026
- Medium6.3Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using…Check if you run itEPSS 0.25%Oct 12, 2026
- Medium5.1Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without pro…Check if you run itEPSS 0.17%Oct 12, 2026
- High7.1Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest u…Check if you run itEPSS 0.22%Oct 12, 2026
- High8.2Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints.Check if you run itEPSS 0.26%Oct 12, 2026
- Medium5.3Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check.Check if you run itEPSS 0.19%Oct 12, 2026
- Medium6.9Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured…Check if you run itEPSS 0.31%Oct 12, 2026
- Medium6.9Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution wh…Check if you run itEPSS 0.32%Oct 12, 2026
- Medium6.9code-projects Matrimonial System matrimony.sql file accessCheck if you run itEPSS 0.31%Oct 12, 2026
- High7.1Nginx UI is a web user interface for the Nginx web server.Check if you run itEPSS 0.17%Oct 12, 2026
- Medium5.1Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform.Check if you run itEPSS 0.30%Oct 12, 2026
- Low2.1A vulnerability was determined in Netcore NR268 1.7.121109.Check if you run itEPSS 0.26%Oct 12, 2026
- Medium5.9GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader.Check if you run itEPSS 0.21%Oct 12, 2026
- Medium4.3Nango is an open-source platform for connecting agents and products to third-party APIs.Check if you run itEPSS 0.29%Oct 12, 2026
- Medium5.7Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities.Check if you run itEPSS 0.16%Oct 12, 2026
- Medium4.3Convex is an open-source reactive database for application developers.Check if you run itEPSS 0.17%Oct 12, 2026
- High8.8Nginx UI is a web user interface for the Nginx web server.Check if you run itEPSS 0.54%Oct 12, 2026
- Critical9.1Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password…Check if you run itEPSS 0.40%Oct 12, 2026
- High8.7IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image r…Check if you run itEPSS 0.23%Oct 12, 2026
- Medium6.5IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image c…Check if you run itEPSS 0.23%Oct 12, 2026
- High8.7IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controll…Check if you run itEPSS 0.67%Oct 12, 2026
- High7.2IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.Check if you run itEPSS 0.26%Oct 12, 2026
- High8.6Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users…Check if you run itEPSS 0.33%Oct 12, 2026
- High8.7N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs.Check if you run itEPSS 0.35%Oct 12, 2026
- Medium5.3SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and…Check if you run itEPSS 0.22%Oct 12, 2026
Sort